<p>Data in a web session is considered inside the "trust boundary". That is, it is assumed to be trustworthy. But storing unvetted data from an unauthenticated user violates the trust boundary, and may lead that that data being used inappropriately.</p>
<p>This rule raises an issue when data from <code>Cookie</code>s or <code>HttpServletRequest</code>s is stored in a session. </p>
<h2>Noncompliant Code Example</h2>

<pre>
login = request.getParameter("login");
session.setAttribute("login", login);  // Noncompliant
</pre>
<h2>See</h2>

<ul>
<li> <a href="http://cwe.mitre.org/data/definitions/501">MITRE, CWE-501</a> - Trust Boundary Violation
</li></ul>

